When you hear that 4.6 million usernames and partial phone numbers have been published online, it’s easy to blame the publisher, but what about the company that may have left all that private data hanging so low on the tree?